eslint-plugin-node-security 4.0.0

package/src/rules/no-buffer-overread/index.js

@@ -0,0 +1,612 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noBufferOverread = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+exports.noBufferOverread = (0, eslint_devkit_1.createRule)({
+    name: 'no-buffer-overread',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects buffer access beyond bounds',
+        },
+        fixable: 'code',
+        hasSuggestions: true,
+        messages: {
+            bufferOverread: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Buffer Overread',
+                cwe: 'CWE-126',
+                description: 'Buffer access beyond allocated bounds',
+                severity: '{{severity}}',
+                fix: '{{safeAlternative}}',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/126.html',
+            }),
+            unsafeBufferAccess: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Unsafe Buffer Access',
+                cwe: 'CWE-126',
+                description: 'Buffer accessed without bounds validation',
+                severity: 'HIGH',
+                fix: 'Add bounds check before buffer access',
+                documentationLink: 'https://nodejs.org/api/buffer.html',
+            }),
+            missingBoundsCheck: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Missing Bounds Check',
+                cwe: 'CWE-126',
+                description: 'Buffer operation missing bounds validation',
+                severity: 'MEDIUM',
+                fix: 'Validate indices before buffer operations',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/126.html',
+            }),
+            negativeBufferIndex: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Negative Buffer Index',
+                cwe: 'CWE-126',
+                description: 'Negative index used for buffer access',
+                severity: 'MEDIUM',
+                fix: 'Ensure buffer indices are non-negative',
+                documentationLink: 'https://nodejs.org/api/buffer.html',
+            }),
+            userControlledBufferIndex: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'User Controlled Buffer Index',
+                cwe: 'CWE-126',
+                description: 'Buffer accessed with user-controlled index',
+                severity: 'HIGH',
+                fix: 'Validate user input before using as buffer index',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/126.html',
+            }),
+            unsafeBufferSlice: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Unsafe Buffer Slice',
+                cwe: 'CWE-126',
+                description: 'Buffer slice with unvalidated indices',
+                severity: 'MEDIUM',
+                fix: 'Validate slice start/end indices',
+                documentationLink: 'https://nodejs.org/api/buffer.html#bufslicestart-end',
+            }),
+            bufferLengthNotChecked: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'Buffer Length Not Checked',
+                cwe: 'CWE-126',
+                description: 'Buffer length not validated before access',
+                severity: 'MEDIUM',
+                fix: 'Check buffer.length before operations',
+                documentationLink: 'https://nodejs.org/api/buffer.html#buflength',
+            }),
+            useSafeBufferAccess: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Safe Buffer Access',
+                description: 'Use bounds-checked buffer access methods',
+                severity: 'LOW',
+                fix: 'Use buffer.read*() with offset validation or safe wrapper functions',
+                documentationLink: 'https://nodejs.org/api/buffer.html',
+            }),
+            validateBufferIndices: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Validate Buffer Indices',
+                description: 'Validate buffer indices before use',
+                severity: 'LOW',
+                fix: 'Check 0 <= index < buffer.length',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/126.html',
+            }),
+            checkBufferBounds: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Check Buffer Bounds',
+                description: 'Always check buffer bounds',
+                severity: 'LOW',
+                fix: 'Validate buffer operations against buffer.length',
+                documentationLink: 'https://nodejs.org/api/buffer.html#buflength',
+            }),
+            strategyBoundsChecking: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.STRATEGY,
+                issueName: 'Bounds Checking Strategy',
+                description: 'Implement comprehensive bounds checking',
+                severity: 'LOW',
+                fix: 'Validate all buffer indices and lengths before operations',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/126.html',
+            }),
+            strategyInputValidation: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.STRATEGY,
+                issueName: 'Input Validation Strategy',
+                description: 'Validate user input used as buffer indices',
+                severity: 'LOW',
+                fix: 'Sanitize and validate all user input before buffer operations',
+                documentationLink: 'https://nodejs.org/api/buffer.html',
+            }),
+            strategySafeBuffers: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.STRATEGY,
+                issueName: 'Safe Buffer Strategy',
+                description: 'Use safe buffer wrapper libraries',
+                severity: 'LOW',
+                fix: 'Use libraries that provide bounds-checked buffer operations',
+                documentationLink: 'https://www.npmjs.com/package/safe-buffer',
+            })
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    bufferMethods: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'],
+                    },
+                    boundsCheckFunctions: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'],
+                    },
+                    bufferTypes: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'],
+                    },
+                    trustedSanitizers: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional function names to consider as buffer index validators',
+                    },
+                    trustedAnnotations: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        default: [],
+                        description: 'Additional JSDoc annotations to consider as safe markers',
+                    },
+                    strictMode: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Disable all false positive detection (strict mode)',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            bufferMethods: ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'],
+            boundsCheckFunctions: ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'],
+            bufferTypes: ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'],
+            trustedSanitizers: [],
+            trustedAnnotations: [],
+            strictMode: false,
+        },
+    ],
+    create(context) {
+        const options = context.options[0] || {};
+        const { bufferMethods = ['readUInt8', 'readUInt16LE', 'readUInt32LE', 'readInt8', 'readInt16LE', 'readInt32LE', 'writeUInt8', 'writeUInt16LE', 'writeUInt32LE', 'slice', 'copy'], boundsCheckFunctions = ['validateIndex', 'checkBounds', 'safeIndex', 'validateBufferIndex'], bufferTypes = ['Buffer', 'Uint8Array', 'ArrayBuffer', 'DataView'], trustedSanitizers = [], trustedAnnotations = [], strictMode = false, } = options;
+        const sourceCode = context.sourceCode || context.sourceCode;
+        const filename = context.filename || context.getFilename();
+        // Create safety checker for false positive detection
+        const safetyChecker = (0, eslint_devkit_1.createSafetyChecker)({
+            trustedSanitizers,
+            trustedAnnotations,
+            trustedOrmPatterns: [],
+            strictMode,
+        });
+        // Pre-compute Sets for O(1) lookups (performance optimization)
+        const bufferTypesSet = new Set(bufferTypes.map(t => t.toLowerCase()));
+        const userControlledKeywords = new Set(['req', 'request', 'query', 'params', 'input', 'user', 'offset', 'index', 'body']);
+        // Track buffer variables
+        const bufferVars = new Set();
+        /**
+         * Check if variable is a buffer type
+         * Uses Set-based lookup for O(1) performance
+         */
+        const isBufferType = (varName) => {
+            if (bufferVars.has(varName))
+                return true;
+            const lowerName = varName.toLowerCase();
+            for (const type of bufferTypesSet) {
+                if (lowerName.includes(type))
+                    return true;
+            }
+            return false;
+        };
+        /**
+         * Check if index is user-controlled
+         * Uses Set-based keyword matching for O(1) lookups
+         */
+        const isUserControlledIndex = (indexNode) => {
+            if (indexNode.type === 'Identifier') {
+                const varName = indexNode.name.toLowerCase();
+                // Check each part of the variable name against keywords Set
+                for (const keyword of userControlledKeywords) {
+                    if (varName.includes(keyword))
+                        return true;
+                }
+                // Trace variable definition
+                let currentScope = sourceCode.getScope(indexNode);
+                let variable = null;
+                while (currentScope) {
+                    variable = currentScope.variables.find(v => v.name === indexNode.name) || null;
+                    if (variable)
+                        break;
+                    currentScope = currentScope.upper;
+                }
+                if (variable && variable.defs.length > 0) {
+                    const def = variable.defs[0];
+                    if (def.type === 'Variable' && def.node.init) {
+                        const init = def.node.init;
+                        // Check MemberExpression involving user keywords (e.g. req.body.index)
+                        if (init.type === 'MemberExpression') {
+                            const objectText = sourceCode.getText(init.object).toLowerCase();
+                            const propertyText = sourceCode.getText(init.property).toLowerCase();
+                            const keywords = ['req', 'request', 'query', 'params', 'input', 'user', 'body'];
+                            if (keywords.some(k => objectText.includes(k) || propertyText.includes(k))) {
+                                return true;
+                            }
+                        }
+                        // Check CallExpression with user-controlled arguments (Number(req.query.index), parseInt(), etc.)
+                        if (init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
+                            // Check if callee is a type conversion function
+                            const typeConversionFunctions = ['number', 'parseint', 'parsefloat', 'string', 'boolean'];
+                            let isTypeConversion = false;
+                            if (init.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+                                isTypeConversion = typeConversionFunctions.includes(init.callee.name.toLowerCase());
+                            }
+                            // If it's a type conversion, check if the argument is user-controlled
+                            if (isTypeConversion && init.arguments.length > 0) {
+                                return isUserControlledIndex(init.arguments[0]);
+                            }
+                        }
+                        // Recursive check for Identifier assignment
+                        if (init.type === 'Identifier' && init.name !== indexNode.name) {
+                            return isUserControlledIndex(init);
+                        }
+                    }
+                }
+            }
+            // Check CallExpression arguments (Number(req.query.index))
+            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
+                const typeConversionFunctions = ['Number', 'parseInt', 'parseFloat', 'String', 'Boolean'];
+                if (indexNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                    typeConversionFunctions.includes(indexNode.callee.name)) {
+                    // Check if arguments are user-controlled
+                    for (const arg of indexNode.arguments) {
+                        if (isUserControlledIndex(arg)) {
+                            return true;
+                        }
+                    }
+                }
+            }
+            // Check MemberExpression (req.query.index)
+            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression) {
+                const text = sourceCode.getText(indexNode).toLowerCase();
+                const keywords = ['req.', 'request.', 'query.', 'params.', 'body.', 'input.', 'user.'];
+                if (keywords.some(k => text.includes(k))) {
+                    return true;
+                }
+            }
+            return false;
+        };
+        /**
+         * Check if index has been validated
+         */
+        const isIndexValidated = (indexNode) => {
+            // If it's a literal number, check if it's non-negative
+            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof indexNode.value === 'number') {
+                return indexNode.value >= 0;
+            }
+            // If it's an identifier, check if it comes from a bounds check function
+            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+                let current = indexNode;
+                // Walk up the AST to find where this variable was assigned
+                while (current) {
+                    // Check if we're in a variable declaration
+                    if (current.type === eslint_devkit_1.AST_NODE_TYPES.VariableDeclarator &&
+                        current.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                        current.id.name === indexNode.name &&
+                        current.init) {
+                        const init = current.init;
+                        // Check if assigned from a bounds check function
+                        if (init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
+                            init.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                            boundsCheckFunctions.includes(init.callee.name)) {
+                            return true;
+                        }
+                        // Check if assigned from Math.min/max with buffer.length
+                        if (init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
+                            init.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+                            init.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                            init.callee.object.name === 'Math' &&
+                            init.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                            (init.callee.property.name === 'min' || init.callee.property.name === 'max')) {
+                            return true;
+                        }
+                        break;
+                    }
+                    // Check if it's a parameter in a function - assume validated if it's a function param
+                    if (current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration ||
+                        current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionExpression ||
+                        current.type === eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression) {
+                        const params = current.params;
+                        for (const param of params) {
+                            if (param.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && param.name === indexNode.name) {
+                                return true; // Function parameters are assumed validated
+                            }
+                        }
+                    }
+                    current = current.parent;
+                }
+            }
+            // Check if it's a call to a bounds check function directly
+            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
+                indexNode.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                boundsCheckFunctions.includes(indexNode.callee.name)) {
+                return true;
+            }
+            return false;
+        };
+        /**
+         * Check if there's a bounds check in the current scope
+         */
+        const hasBoundsCheck = (bufferName, indexNode) => {
+            // Look for bounds checks in the current function scope
+            let current = indexNode;
+            while (current) {
+                // Check if we're in a function
+                if (current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionDeclaration ||
+                    current.type === eslint_devkit_1.AST_NODE_TYPES.FunctionExpression ||
+                    current.type === eslint_devkit_1.AST_NODE_TYPES.ArrowFunctionExpression) {
+                    break;
+                }
+                // Look for if statements that check bounds
+                if (current.type === eslint_devkit_1.AST_NODE_TYPES.IfStatement) {
+                    const condition = current.test;
+                    const conditionText = sourceCode.getText(condition).toLowerCase();
+                    // Check for bounds checking patterns
+                    if (conditionText.includes(`${bufferName}.length`) &&
+                        (conditionText.includes('<') || conditionText.includes('<=') ||
+                            conditionText.includes('>') || conditionText.includes('>=') ||
+                            conditionText.includes('&&') || conditionText.includes('||'))) {
+                        return true;
+                    }
+                }
+                // Look for variable declarations that might be bounds checks
+                if (current.type === eslint_devkit_1.AST_NODE_TYPES.VariableDeclaration) {
+                    for (const declarator of current.declarations) {
+                        if (declarator.init) {
+                            const initText = sourceCode.getText(declarator.init).toLowerCase();
+                            if (initText.includes(`${bufferName}.length`) &&
+                                (initText.includes('math.min') || initText.includes('math.max') ||
+                                    initText.includes('mathmin') || initText.includes('mathmax'))) {
+                                return true;
+                            }
+                        }
+                    }
+                }
+                // Look for return statements or early returns that might indicate bounds checking
+                if (current.type === eslint_devkit_1.AST_NODE_TYPES.ReturnStatement && current.argument) {
+                    const returnText = sourceCode.getText(current.argument).toLowerCase();
+                    if (returnText.includes(`${bufferName}.length`)) {
+                        return true;
+                    }
+                }
+                current = current.parent;
+            }
+            return false;
+        };
+        /**
+         * Check if index could be negative
+         */
+        const couldBeNegative = (indexNode) => {
+            // Check for literal negative numbers
+            // Check for literal negative numbers
+            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof indexNode.value === 'number') {
+                return indexNode.value < 0;
+            }
+            // Check for unary minus expressions like -1, -10, etc.
+            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.UnaryExpression &&
+                indexNode.operator === '-' &&
+                indexNode.argument.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
+                typeof indexNode.argument.value === 'number') {
+                return true; // -N is always negative for positive N
+            }
+            // Check for binary expressions that could be negative like userInput - 10
+            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.BinaryExpression && indexNode.operator === '-') {
+                // userInput - 10 could be negative, we can't be sure statically
+                return true; // Conservative: assume it could be negative
+            }
+            // For variables, we can't be sure, but we can check for obvious patterns
+            if (indexNode.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+                // Check if this variable is assigned a negative value somewhere
+                // This is a simplified check - in practice we'd need more sophisticated analysis
+                let current = indexNode;
+                while (current) {
+                    if (current.type === eslint_devkit_1.AST_NODE_TYPES.VariableDeclarator && current.init) {
+                        if (current.init.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
+                            typeof current.init.value === 'number' &&
+                            current.init.value < 0) {
+                            return true;
+                        }
+                        // Check for unary minus assignments
+                        if (current.init.type === eslint_devkit_1.AST_NODE_TYPES.UnaryExpression &&
+                            current.init.operator === '-' &&
+                            current.init.argument.type === eslint_devkit_1.AST_NODE_TYPES.Literal &&
+                            typeof current.init.argument.value === 'number') {
+                            return true;
+                        }
+                    }
+                    current = current.parent;
+                }
+            }
+            return false;
+        };
+        return {
+            // Track buffer variable declarations
+            VariableDeclarator(node) {
+                if (node.id.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && node.init) {
+                    const varName = node.id.name;
+                    // Check if assigned a buffer type
+                    if (node.init.type === eslint_devkit_1.AST_NODE_TYPES.NewExpression &&
+                        node.init.callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                        bufferTypes.includes(node.init.callee.name)) {
+                        bufferVars.add(varName);
+                    }
+                    // Check if assigned from Buffer.from() or Buffer.alloc()
+                    if (node.init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression &&
+                        node.init.callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+                        node.init.callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                        node.init.callee.object.name === 'Buffer' &&
+                        node.init.callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                        ['from', 'alloc', 'allocUnsafe'].includes(node.init.callee.property.name)) {
+                        bufferVars.add(varName);
+                    }
+                    // Check if assigned a buffer method result
+                    if (node.init.type === eslint_devkit_1.AST_NODE_TYPES.CallExpression) {
+                        const callee = node.init.callee;
+                        if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+                            callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                            bufferMethods.includes(callee.property.name)) {
+                            bufferVars.add(varName);
+                        }
+                    }
+                    // Check variable name patterns
+                    if (bufferTypes.some(type => varName.toLowerCase().includes(type.toLowerCase()))) {
+                        bufferVars.add(varName);
+                    }
+                }
+            },
+            // Check member expressions (buffer[index], buffer.method())
+            MemberExpression(node) {
+                // Check for buffer[index] access
+                if (node.computed && node.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier) {
+                    const bufferName = node.object.name;
+                    const indexNode = node.property;
+                    if (isBufferType(bufferName)) {
+                        // Check for negative indices
+                        if (couldBeNegative(indexNode)) {
+                            context.report({
+                                node,
+                                messageId: 'negativeBufferIndex',
+                                data: {
+                                    filePath: filename,
+                                    line: String(node.loc?.start.line ?? 0),
+                                },
+                            });
+                            return;
+                        }
+                        // Check for user-controlled indices without validation
+                        if (isUserControlledIndex(indexNode) && !isIndexValidated(indexNode)) {
+                            // Check if there's a bounds check in scope
+                            if (!hasBoundsCheck(bufferName, indexNode)) {
+                                /* c8 ignore start -- safetyChecker.isSafe requires JSDoc annotations not testable via RuleTester */
+                                if (safetyChecker.isSafe(node, context)) {
+                                    return;
+                                }
+                                /* c8 ignore stop */
+                                context.report({
+                                    node,
+                                    messageId: 'userControlledBufferIndex',
+                                    data: {
+                                        filePath: filename,
+                                        line: String(node.loc?.start.line ?? 0),
+                                    },
+                                });
+                                return;
+                            }
+                        }
+                        // Check if there's any bounds validation
+                        if (!hasBoundsCheck(bufferName, indexNode) && !isIndexValidated(indexNode)) {
+                            /* c8 ignore start -- safetyChecker.isSafe requires JSDoc annotations not testable via RuleTester */
+                            if (safetyChecker.isSafe(node, context)) {
+                                return;
+                            }
+                            /* c8 ignore stop */
+                            context.report({
+                                node,
+                                messageId: 'unsafeBufferAccess',
+                                data: {
+                                    filePath: filename,
+                                    line: String(node.loc?.start.line ?? 0),
+                                },
+                            });
+                        }
+                    }
+                }
+                // Check for buffer method calls that need bounds checking
+                if (node.property.type === 'Identifier' &&
+                    bufferMethods.includes(node.property.name) &&
+                    node.object.type === 'Identifier' &&
+                    isBufferType(node.object.name)) {
+                    // This is a parent of a CallExpression, we'll check it there
+                }
+            },
+            // Check buffer method calls
+            CallExpression(node) {
+                const callee = node.callee;
+                // Check for buffer.slice() calls
+                if (callee.type === 'MemberExpression' &&
+                    callee.property.type === 'Identifier' &&
+                    callee.property.name === 'slice' &&
+                    callee.object.type === 'Identifier' &&
+                    isBufferType(callee.object.name)) {
+                    const args = node.arguments;
+                    // Check slice arguments
+                    for (const arg of args) {
+                        if (isUserControlledIndex(arg) && !isIndexValidated(arg)) {
+                            /* c8 ignore start -- safetyChecker.isSafe requires JSDoc annotations not testable via RuleTester */
+                            if (safetyChecker.isSafe(node, context)) {
+                                continue;
+                            }
+                            /* c8 ignore stop */
+                            context.report({
+                                node: arg,
+                                messageId: 'unsafeBufferSlice',
+                                data: {
+                                    filePath: filename,
+                                    line: String(node.loc?.start.line ?? 0),
+                                },
+                            });
+                        }
+                    }
+                }
+                // Check for buffer read/write methods
+                if (callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+                    callee.property.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                    bufferMethods.includes(callee.property.name) &&
+                    callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                    isBufferType(callee.object.name)) {
+                    const args = node.arguments;
+                    // Check offset/length arguments
+                    for (const arg of args) {
+                        if (isUserControlledIndex(arg) && !isIndexValidated(arg)) {
+                            /* c8 ignore start -- safetyChecker.isSafe requires JSDoc annotations not testable via RuleTester */
+                            if (safetyChecker.isSafe(node, context)) {
+                                continue;
+                            }
+                            /* c8 ignore stop */
+                            context.report({
+                                node: arg,
+                                messageId: 'missingBoundsCheck',
+                                data: {
+                                    filePath: filename,
+                                    line: String(node.loc?.start.line ?? 0),
+                                },
+                            });
+                        }
+                    }
+                }
+            },
+            // Check binary expressions that might involve buffer operations
+            BinaryExpression(node) {
+                // Look for patterns like buffer.length - something that might indicate bounds checking
+                const leftText = sourceCode.getText(node.left);
+                const rightText = sourceCode.getText(node.right);
+                if (leftText.includes('.length') || rightText.includes('.length')) {
+                    // This might be a bounds check - we could analyze this further
+                }
+            }
+        };
+    },
+});
+//# sourceMappingURL=index.js.map

package/src/rules/no-buffer-overread/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../packages/eslint-plugin-node-security/src/rules/no-buffer-overread/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAkBH,4DAA2H;AAqC9G,QAAA,gBAAgB,GAAG,IAAA,0BAAU,EAA0B;IAClE,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,qCAAqC;SACnD;QACD,OAAO,EAAE,MAAM;QACf,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE;YACR,cAAc,EAAE,IAAA,gCAAgB,EAAC;gBAC/B,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,iBAAiB;gBAC5B,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,uCAAuC;gBACpD,QAAQ,EAAE,cAAc;gBACxB,GAAG,EAAE,qBAAqB;gBAC1B,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,sBAAsB;gBACjC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,2CAA2C;gBACxD,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,uCAAuC;gBAC5C,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,kBAAkB,EAAE,IAAA,gCAAgB,EAAC;gBACnC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,sBAAsB;gBACjC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,4CAA4C;gBACzD,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,2CAA2C;gBAChD,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,uBAAuB;gBAClC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,uCAAuC;gBACpD,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,wCAAwC;gBAC7C,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,yBAAyB,EAAE,IAAA,gCAAgB,EAAC;gBAC1C,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,8BAA8B;gBACzC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,4CAA4C;gBACzD,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,kDAAkD;gBACvD,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,qBAAqB;gBAChC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,uCAAuC;gBACpD,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,kCAAkC;gBACvC,iBAAiB,EAAE,sDAAsD;aAC1E,CAAC;YACF,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,GAAG,EAAE,SAAS;gBACd,WAAW,EAAE,2CAA2C;gBACxD,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,uCAAuC;gBAC5C,iBAAiB,EAAE,8CAA8C;aAClE,CAAC;YACF,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,wBAAwB;gBACnC,WAAW,EAAE,0CAA0C;gBACvD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,qEAAqE;gBAC1E,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,qBAAqB,EAAE,IAAA,gCAAgB,EAAC;gBACtC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,yBAAyB;gBACpC,WAAW,EAAE,oCAAoC;gBACjD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kCAAkC;gBACvC,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,iBAAiB,EAAE,IAAA,gCAAgB,EAAC;gBAClC,IAAI,EAAE,4BAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,WAAW,EAAE,4BAA4B;gBACzC,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,kDAAkD;gBACvD,iBAAiB,EAAE,8CAA8C;aAClE,CAAC;YACF,sBAAsB,EAAE,IAAA,gCAAgB,EAAC;gBACvC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,0BAA0B;gBACrC,WAAW,EAAE,yCAAyC;gBACtD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,2DAA2D;gBAChE,iBAAiB,EAAE,iDAAiD;aACrE,CAAC;YACF,uBAAuB,EAAE,IAAA,gCAAgB,EAAC;gBACxC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,2BAA2B;gBACtC,WAAW,EAAE,4CAA4C;gBACzD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,+DAA+D;gBACpE,iBAAiB,EAAE,oCAAoC;aACxD,CAAC;YACF,mBAAmB,EAAE,IAAA,gCAAgB,EAAC;gBACpC,IAAI,EAAE,4BAAY,CAAC,QAAQ;gBAC3B,SAAS,EAAE,sBAAsB;gBACjC,WAAW,EAAE,mCAAmC;gBAChD,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,6DAA6D;gBAClE,iBAAiB,EAAE,2CAA2C;aAC/D,CAAC;SACH;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,aAAa,EAAE;wBACb,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC;qBAClK;oBACD,oBAAoB,EAAE;wBACpB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,qBAAqB,CAAC;qBAC9E;oBACD,WAAW,EAAE;wBACX,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;qBAC7D;oBACD,iBAAiB,EAAE;wBACjB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,kEAAkE;qBAChF;oBACD,kBAAkB,EAAE;wBAClB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE;wBACX,WAAW,EAAE,0DAA0D;qBACxE;oBACD,UAAU,EAAE;wBACV,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EAAE,oDAAoD;qBAClE;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;KACF;IACD,cAAc,EAAE;QACd;YACE,aAAa,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC;YACvK,oBAAoB,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,qBAAqB,CAAC;YAC1F,WAAW,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;YAChE,iBAAiB,EAAE,EAAE;YACrB,kBAAkB,EAAE,EAAE;YACtB,UAAU,EAAE,KAAK;SAClB;KACF;IACD,MAAM,CAAC,OAAsD;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,EACJ,aAAa,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,EACxK,oBAAoB,GAAG,CAAC,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,qBAAqB,CAAC,EAC3F,WAAW,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC,EACjE,iBAAiB,GAAG,EAAE,EACtB,kBAAkB,GAAG,EAAE,EACvB,UAAU,GAAG,KAAK,GACnB,GAAY,OAAO,CAAC;QAErB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;QAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAE3D,qDAAqD;QACrD,MAAM,aAAa,GAAG,IAAA,mCAAmB,EAAC;YACxC,iBAAiB;YACjB,kBAAkB;YAClB,kBAAkB,EAAE,EAAE;YACtB,UAAU;SACX,CAAC,CAAC;QAEH,+DAA+D;QAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAE1H,yBAAyB;QACzB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC;;;WAGG;QACH,MAAM,YAAY,GAAG,CAAC,OAAe,EAAW,EAAE;YAChD,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACxC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;;WAGG;QACH,MAAM,qBAAqB,GAAG,CAAC,SAAwB,EAAW,EAAE;YAClE,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC7C,4DAA4D;gBAC5D,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;oBAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBAC7C,CAAC;gBAED,4BAA4B;gBAC5B,IAAI,YAAY,GAAgC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAC/E,IAAI,QAAQ,GAAmC,IAAI,CAAC;gBACpD,OAAO,YAAY,EAAE,CAAC;oBACpB,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;oBAC/E,IAAI,QAAQ;wBAAE,MAAM;oBACpB,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC;gBACpC,CAAC;gBAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;wBAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;wBAE3B,uEAAuE;wBACvE,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;4BACnC,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;4BACjE,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;4BAErE,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;4BAChF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gCACzE,OAAO,IAAI,CAAC;4BAChB,CAAC;wBACL,CAAC;wBAED,kGAAkG;wBAClG,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;4BAC9C,gDAAgD;4BAChD,MAAM,uBAAuB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;4BAC1F,IAAI,gBAAgB,GAAG,KAAK,CAAC;4BAE7B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;gCACjD,gBAAgB,GAAG,uBAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;4BACxF,CAAC;4BAED,sEAAsE;4BACtE,IAAI,gBAAgB,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gCAChD,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;4BACpD,CAAC;wBACL,CAAC;wBAED,4CAA4C;wBAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;4BAC7D,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;wBACvC,CAAC;oBACL,CAAC;gBACN,CAAC;YACH,CAAC;YAED,2DAA2D;YAC3D,IAAI,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;gBACnD,MAAM,uBAAuB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC1F,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBACnD,uBAAuB,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1D,yCAAyC;oBACzC,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;wBACpC,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC7B,OAAO,IAAI,CAAC;wBAChB,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;YAED,2CAA2C;YAC3C,IAAI,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;gBACzD,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACvF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,OAAO,IAAI,CAAC;gBAChB,CAAC;YACL,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,gBAAgB,GAAG,CAAC,SAAwB,EAAW,EAAE;YAC7D,uDAAuD;YACvD,IAAI,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACrF,OAAO,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC;YAC9B,CAAC;YAED,wEAAwE;YACxE,IAAI,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;gBACjD,IAAI,OAAO,GAA8B,SAAS,CAAC;gBAEnD,2DAA2D;gBAC3D,OAAO,OAAO,EAAE,CAAC;oBACf,2CAA2C;oBAC3C,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,kBAAkB;wBAClD,OAAO,CAAC,EAAE,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;wBAC7C,OAAO,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;wBAClC,OAAO,CAAC,IAAI,EAAE,CAAC;wBAEjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;wBAE1B,iDAAiD;wBACjD,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;4BAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;4BAC9C,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;4BACpD,OAAO,IAAI,CAAC;wBACd,CAAC;wBAED,yDAAyD;wBACzD,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;4BAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;4BACpD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;4BACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;4BAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;4BACvD,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;4BACjF,OAAO,IAAI,CAAC;wBACd,CAAC;wBAED,MAAM;oBACR,CAAC;oBAED,sFAAsF;oBACtF,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,mBAAmB;wBACnD,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,kBAAkB;wBAClD,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,uBAAuB,EAAE,CAAC;wBAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;wBAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;4BAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gCAC9E,OAAO,IAAI,CAAC,CAAC,4CAA4C;4BAC3D,CAAC;wBACH,CAAC;oBACH,CAAC;oBAED,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;gBAC5C,CAAC;YACH,CAAC;YAED,2DAA2D;YAC3D,IAAI,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;gBAChD,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;gBACnD,oBAAoB,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,SAAwB,EAAW,EAAE;YAC/E,uDAAuD;YACvD,IAAI,OAAO,GAA8B,SAAS,CAAC;YAEnD,OAAO,OAAO,EAAE,CAAC;gBACf,+BAA+B;gBAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,mBAAmB;oBACnD,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,kBAAkB;oBAClD,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,uBAAuB,EAAE,CAAC;oBAC5D,MAAM;gBACR,CAAC;gBAED,2CAA2C;gBAC3C,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,WAAW,EAAE,CAAC;oBAChD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;oBAC/B,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;oBAElE,qCAAqC;oBACrC,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,UAAU,SAAS,CAAC;wBAC9C,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;4BAC3D,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;4BAC3D,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;wBACnE,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAED,6DAA6D;gBAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,mBAAmB,EAAE,CAAC;oBACxD,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;wBAC9C,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;4BACpB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;4BACnE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,UAAU,SAAS,CAAC;gCACzC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;oCAC9D,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gCACnE,OAAO,IAAI,CAAC;4BACd,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,kFAAkF;gBAClF,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACxE,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;oBACtE,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,UAAU,SAAS,CAAC,EAAE,CAAC;wBAChD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAED,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;YAC5C,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF;;WAEG;QACH,MAAM,eAAe,GAAG,CAAC,SAAwB,EAAW,EAAE;YAC5D,qCAAqC;YACrC,qCAAqC;YACrC,IAAI,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACrF,OAAO,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC;YAC7B,CAAC;YAED,uDAAuD;YACvD,IAAI,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;gBACjD,SAAS,CAAC,QAAQ,KAAK,GAAG;gBAC1B,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;gBAClD,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC,CAAC,uCAAuC;YACtD,CAAC;YAED,0EAA0E;YAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrF,gEAAgE;gBAChE,OAAO,IAAI,CAAC,CAAC,4CAA4C;YAC3D,CAAC;YAED,yEAAyE;YACzE,IAAI,SAAS,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;gBACjD,gEAAgE;gBAChE,iFAAiF;gBACjF,IAAI,OAAO,GAA8B,SAAS,CAAC;gBAEnD,OAAO,OAAO,EAAE,CAAC;oBACf,IAAI,OAAO,CAAC,IAAI,KAAK,8BAAc,CAAC,kBAAkB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;wBACvE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;4BAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ;4BACtC,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;4BAC3B,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,oCAAoC;wBACpC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,eAAe;4BACpD,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG;4BAC7B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,OAAO;4BACrD,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;4BACpD,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;oBACD,OAAO,GAAG,OAAO,CAAC,MAAuB,CAAC;gBAC5C,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,OAAO;YACL,qCAAqC;YACrC,kBAAkB,CAAC,IAAiC;gBAClD,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;oBAE7B,kCAAkC;oBAClC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,aAAa;wBAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;wBACnD,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC1B,CAAC;oBAED,yDAAyD;oBACzD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc;wBAChD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;wBACzD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;wBAC1D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;wBACzC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;wBAC5D,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC7E,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC3B,CAAC;oBAED,2CAA2C;oBAC3C,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,8BAAc,CAAC,cAAc,EAAE,CAAC;wBACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;wBAChC,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;4BAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;4BAClD,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;4BACjD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBAC1B,CAAC;oBACH,CAAC;oBAED,+BAA+B;oBAC/B,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;wBACjF,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,4DAA4D;YAC5D,gBAAgB,CAAC,IAA+B;gBAC9C,iCAAiC;gBACjC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU,EAAE,CAAC;oBACpE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACpC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;oBAEhC,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC7B,6BAA6B;wBAC7B,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;4BAC/B,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI;gCACJ,SAAS,EAAE,qBAAqB;gCAChC,IAAI,EAAE;oCACJ,QAAQ,EAAE,QAAQ;oCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;iCACxC;6BACF,CAAC,CAAC;4BACH,OAAO;wBACT,CAAC;wBAED,uDAAuD;wBACvD,IAAI,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;4BACrE,2CAA2C;4BAC3C,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;gCAC3C,oGAAoG;gCACpG,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;oCACxC,OAAO;gCACT,CAAC;gCACD,oBAAoB;gCAEpB,OAAO,CAAC,MAAM,CAAC;oCACb,IAAI;oCACJ,SAAS,EAAE,2BAA2B;oCACtC,IAAI,EAAE;wCACJ,QAAQ,EAAE,QAAQ;wCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;qCACxC;iCACF,CAAC,CAAC;gCACH,OAAO;4BACT,CAAC;wBACH,CAAC;wBAED,yCAAyC;wBACzC,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;4BAC7E,oGAAoG;4BACpG,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gCACxC,OAAO;4BACT,CAAC;4BACD,oBAAoB;4BAElB,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI;gCACJ,SAAS,EAAE,oBAAoB;gCAC/B,IAAI,EAAE;oCACJ,QAAQ,EAAE,QAAQ;oCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;iCACxC;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,0DAA0D;gBAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBACnC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACjC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAEnC,6DAA6D;gBAC/D,CAAC;YACH,CAAC;YAED,4BAA4B;YAC5B,cAAc,CAAC,IAA6B;gBAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBAE3B,iCAAiC;gBACjC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;oBAChC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACnC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAErC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;oBAE5B,wBAAwB;oBACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC3D,oGAAoG;4BAClG,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gCACxC,SAAS;4BACX,CAAC;4BACD,oBAAoB;4BAEpB,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI,EAAE,GAAG;gCACT,SAAS,EAAE,mBAAmB;gCAC9B,IAAI,EAAE;oCACJ,QAAQ,EAAE,QAAQ;oCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;iCACxC;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,sCAAsC;gBACtC,IAAI,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,gBAAgB;oBAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAClD,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC5C,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,8BAAc,CAAC,UAAU;oBAChD,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAErC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;oBAE5B,gCAAgC;oBAChC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;4BACzD,oGAAoG;4BACpG,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gCACxC,SAAS;4BACX,CAAC;4BACD,oBAAoB;4BAEpB,OAAO,CAAC,MAAM,CAAC;gCACb,IAAI,EAAE,GAAG;gCACT,SAAS,EAAE,oBAAoB;gCAC/B,IAAI,EAAE;oCACJ,QAAQ,EAAE,QAAQ;oCAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;iCACxC;6BACF,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,gEAAgE;YAChE,gBAAgB,CAAC,IAA+B;gBAC9C,uFAAuF;gBACvF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAEjD,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAClE,+DAA+D;gBACjE,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}